Power Query and OAuth2: Fixing “The credentials provided for the source are invalid.”

The error “The credentials provided for the source are invalid” occurs during OAuth2 authentication when Power Query presents an expired, revoked, or incorrectly scoped access token to a cloud service. This typically happens when connecting to Microsoft 365, SharePoint Online, Azure Data Lake, Salesforce, or Google BigQuery.

Quick Answer:

Open Excel and go to Data > Get Data > Data Source Settings. Under Global permissions, locate your source URL, click Clear Permissions, and click Close. Re-run your query, select Organizational Account (or the platform-specific OAuth provider), click Sign In to refresh your cloud token through the web prompt, and click Connect.

---

Root Causes of OAuth2 Failures in Power Query

OAuth2 relies on short-lived access tokens and longer-lived refresh tokens. Unlike static passwords, these tokens expire or become invalid under specific conditions:

1. Token Expiration or Revocation: Password changes, Multi-Factor Authentication (MFA) resets, or security policy updates revoke the cached refresh token.
2. URL Scope Mismatch: Credentials were saved against a specific subfolder or site instead of the root service URL, causing the authorization token to be rejected on broader calls.
3. MFA and Conditional Access Interception: Corporate Azure Active Directory (Microsoft Entra ID) policies require periodic re-authentication or block silent token renewals from desktop applications.
4. Tenant ID Conflicts: The user is signed into Excel with a personal Microsoft account while trying to authenticate against a corporate work tenant (or vice-versa).

---

Step 1: Clear Cached OAuth Tokens

Power Query stores OAuth tokens in a local Windows cache. When a token expires, Excel often attempts to reuse it rather than launching a new sign-in window, triggering the error repeatedly.

1. Open Excel and navigate to the Data tab.
2. Select Get Data > Data Source Settings.
3. In the dialog, select Global permissions.
4. Scroll through the list and find all instances of the connection target (e.g., https://yourcompany.sharepoint.com or https://login.microsoftonline.com).
5. Select each entry and click Clear Permissions (or Delete).
6. Click Close.

(For step-by-step guidance on removing lingering connection profiles across multiple drives, see Managing Data Source Settings: How to clear and reset Global Permissions).

---

Step 2: Reconnect Using the Correct Scope Level

When re-authenticating, applying permissions to the wrong URL level can break subsequent queries:

1. Trigger a data refresh or reopen the Power Query Editor.
2. When the credential prompt appears, choose the appropriate OAuth provider from the left sidebar:
   • Organizational Account: For Microsoft 365, SharePoint, Azure SQL, and Fabric.
   • Salesforce / Google / Third-Party: Select the vendor-specific option.
3. Check the dropdown menu labeled Select which level to apply these settings to:
   • Do not select a granular file path (e.g., https://tenant.sharepoint.com/sites/Dept/Folder/File.xlsx).
   • Do select the root site or tenant level (e.g., https://tenant.sharepoint.com/sites/Dept or https://tenant.sharepoint.com).
4. Click Sign in.

Select which level to apply these settings to:
├── [X] <https://tenant.sharepoint.com/sites/team/data/file.xlsx>  (Scope too narrow: causes errors)
└── [✓] <https://tenant.sharepoint.com/sites/team>                 (Correct site scope)

1. Complete the sign-in prompt in the browser window, approve the MFA notification, and confirm that the dialog displays: “You are currently signed in.”
2. Click Connect.

---

Step 3: Resolving Browser and WebView2 Caching Conflicts

Power Query uses the Microsoft Edge WebView2 runtime to display OAuth sign-in pages. If the embedded browser retains an old session state, it may automatically pass invalid credentials:

1. Close Excel completely.
2. Clear your default web browser’s cache and cookies for login.microsoftonline.com or your OAuth identity provider.
3. Open Windows Credential Manager:
   • Press Windows Key + R, type control keymgr.dll, and press Enter.
   • Select Windows Credentials.
   • Look under Generic Credentials for entries starting with MicrosoftOffice16_Data:orgid or the name of your cloud service.
   • Remove these entries to force Excel to request a clean OAuth handshake.
4. Relaunch Excel and attempt the connection again.

---

Step 4: Anticipate Downstream Permission Errors

If re-authenticating resolves the “credentials provided are invalid” error but immediately results in an HTTP access denial, your credentials were authenticated successfully, but your user account lacks permissions on the target resource.

If this happens, review Solving “The remote server returned an error: (403) Forbidden.” to distinguish between identity failures and authorization boundaries.